[TASK] Implement session list and kill endpoints

Description

Implement session management endpoints in MaintenanceResource.java for the Maintenance portlet Logged Users tab. Three endpoints: list active sessions, kill a specific session, and kill all sessions. Must preserve the HMAC session ID obfuscation and CSRF token security model from the existing DWR implementation (UserSessionAjax).

Acceptance Criteria

GET /v1/maintenance/_sessions

• API caller must receive a list of active sessions with: userId, userEmail, userFullName, remote IP address, session start time (pretty formatted), and an isCurrent flag
• Session IDs must never be exposed — each session must be represented by an HMAC-SHA256 obfuscated token (truncated to 16 bytes, Base64 URL-encoded)
• Endpoint must generate a CSRF token (UUID), store it in the caller's HTTP session with a timestamp, and use it as the HMAC secret key
• Must require CMS Administrator role and Maintenance portlet access

DELETE /v1/maintenance/_sessions/{token}

• API caller must be able to kill a specific session using the HMAC token from the list response
• Endpoint must validate the CSRF token stored in the caller's session — reject with 403 if expired (>15 minutes since list was fetched) or missing
• Endpoint must iterate all sessions and HMAC-validate the token to find the target session
• API caller must receive 400 if attempting to kill their own session
• API caller must receive 404 if token doesn't match any active session
• Killed session must have SessionMonitor.IGNORE_REMEMBER_ME_ON_INVALIDATION attribute set to true before session.invalidate() is called

DELETE /v1/maintenance/_sessions

• API caller must be able to kill all sessions except their own in a single call
• All killed sessions must have IGNORE_REMEMBER_ME_ON_INVALIDATION set before invalidation
• API caller must receive count of killed sessions in response
• Must require CMS Administrator role and Maintenance portlet access

Priority

None

Additional Context

• UserSessionAjax.java has reusable static methods: obfuscateSessionId(sessionId, secretKey) and validateSessionId(sessionId, secretKey, obfuscatedId) — consider extracting to a shared utility
• Session tracking: SessionMonitor.getUserSessions() returns Map<String, HttpSession>
• Session user lookup: PortalUtil.getUser(session) — may return null for anonymous sessions
• IGNORE_REMEMBER_ME_ON_INVALIDATION prevents the "remember me" cookie from automatically recreating the session after invalidation
• The CSRF token is generated per getSessionList() call and has 15-minute expiry — if the user hasn't refreshed the session list in 15 minutes, kill requests will fail with 403 and the client must re-fetch the list
• DWR legacy: UserSessionAjax.java lines 71–153

Start with MaintenanceResource.java and compare the existing DWR implementation in UserSessionAjax.java, especially lines 71–153 and its obfuscation helpers. Review SessionMonitor.getUserSessions() and PortalUtil.getUser(session) before implementing the three endpoints. Done means the listed fields, HMAC tokens, CSRF expiry, role and portlet checks, status responses, and session invalidation behavior meet the acceptance criteria.